Īnd again, you will not find these AppLocker rules in GPO, because it is not using GPO. Now you should able to see this settings from WMI Explorer or with PowerShell (also need use psexec.exe /i /s)Īnd you will also find your settings in C:\Windows\System32\AppLocker\MDM folder. Step 4: Now you can run the following script as example, you can change $GroupName as your wish and configure your own AppLocker RuleCollections. Step 3: Type whoami, you should see this is now running as nt authority\system Step 2: unzip pxexec tool, run psexec.exe /i /s PowerShell_ISE.exe from an elevated admin command prompt This is a device setting, for all device settings, the WMI Bridge client must be executed under local system. Take AppLocker EXE rules for example, it’s MDM Bridge WMI Class is located in MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. Typically, these settings map to registry keys, files, or permissions. Peter van der Woude has written an excellent blog post a few years ago about Windows 10 MDM and the MDM Bridge WMI Provider, it will give your more insights about what is MDM Bridge WMI Provider and how it works.ĬSPs are similar to Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature.
The answer is fairly simple: Use PowerShell with the WMI Bridge Provider
So the question is, if you are not managing your devices with Microsoft Intune or Co-Management, how to configure AppLocker for Windows 10 Pro? If you use Group Policy, you will see a warning from AppLocker event log, that AppLocker component not available on this SKU.įrom MDM Configuration Service Provider Reference, AppLocker CSP does support almost all Windows versions, except Business, you can use Intune OMA-URL configure AppLocker settings, there are lots of good blog posts about this. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016.īeing said, you cannot use Group Policy configure AppLocker for Windows 10 Pro, but it doesn’t mean that AppLocker doesn’t support Windows 10 Pro. You can use the AppLocker CSPto configure AppLocker policies on any edition of Windows 10 supported by Mobile Device Management (MDM). I often see questions about “Does AppLocker work in Windows 10 Pro?”, “Can we manage AppLocker in Windows 10 Pro”? The simple answer is YES! In this post, I will tell you how. This is a short post, but it took me some time to test it out and make sure it works, hope this is useful.
0 kommentar(er)
